# Original granted scopes not not available in rules/action when refreshing token

**URL:** <https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419>\
**Category:** Get Help\
**Tags:** actions, rules\
**Created:** [November 1, 2021, 12:50pm UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419 "2021-11-01T12:50:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![christian.hunstad](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/christian.hunstad/32/12821_2.png) [@christian.hunstad](https://community.auth0.com/u/christian.hunstad)\
**Post date:** [November 1, 2021, 12:50pm UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/1 "2021-11-01T12:50:26Z")

</div>

Hello,

I found this post that was closed in 2019 that describes my problem: [How to get originally granted scopes when renewing token in Auth0 Rules?](https://community.auth0.com/t/how-to-get-originally-granted-scopes-when-renewing-token-in-auth0-rules/25694)

When refreshing an access token, the originally granted scopes is nowhere to be found when a rule or action is executed. We have some logic in auth0 rules adding som data to the access token if a custom scope is provided in the request body, and are now trying to add refresh tokens to our application.

I am using the auth0 express-openid-connect middleware, and could pass the scopes to the refresh request. But omitting the scopes in the refresh request should result in it being treated as equal to the scope originally granted by the resource owner.

Should I have to resend the scopes in the request for refreshing my access token in order to see them within a rule or action?

---

<div class="post-metadata">

**Author:** ![aranjan1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aranjan1/32/33801_2.png) [@aranjan1](https://community.auth0.com/u/aranjan1)\
**Post date:** [March 10, 2022, 2:24am UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/2 "2022-03-10T02:24:03Z")

</div>

I have the same question. @christian.hunstad pl post here if you found a solution/workaround.

---

<div class="post-metadata">

**Author:** ![rbarber](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rbarber/32/14934_2.png) [@rbarber](https://community.auth0.com/u/rbarber)\
**Post date:** [April 14, 2022, 6:12pm UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/3 "2022-04-14T18:12:15Z")

</div>

I am experiencing the same issue. Anyone have a solution? @christian.hunstad @aranjan1

---

<div class="post-metadata">

**Author:** ![arao1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/arao1/32/33801_2.png) [@arao1](https://community.auth0.com/u/arao1)\
**Post date:** [December 19, 2022, 4:22pm UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/4 "2022-12-19T16:22:04Z")

</div>

Anyone have a solution for this? I am running into the same situation with missing scopes when using refresh-tokens. Thanks!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [December 24, 2022, 12:27am UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/6 "2022-12-24T00:27:22Z")

</div>

Hey there @arao1 welcome to the community!

If I’m understanding correctly the contents on the Access Token are the same in the token returned, however you’re unable to access any custom scopes added via extensibility previously? A bit of a tricky situation here, but I believe adding custom props on the silent auth may be the only option to pick up in a rule/action:

> <https://github.com/auth0/auth0-spa-js/issues/896#issuecomment-1103647320>
>
> From what I read in the code (and correct if i'm wrong here), while refreshing t…okens I saw that the oauth call doesn't send the \`scopes\` and \`audience\`.
> 
> is it intended to not send these values while refreshing a token?
> 
> I have a situation where I have custom rules set in auth0 and not sending these values break the rule.
> 
> What should I do in this case? 
> 
> Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 9, 2023, 1:23am UTC](https://community.auth0.com/t/original-granted-scopes-not-not-available-in-rules-action-when-refreshing-token/72419/7 "2023-03-09T01:23:08Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
